What is the CVSS score of CVE-2026-11018?

CVE-2026-11018 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11018?

Yes, a patch is available for CVE-2026-11018. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11018

EUVD-2026-34467 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-04 chrome-cve-admin@google.com

GHSA-vqjx-g56x-4m94

Authentication Bypass Google Chrome Red Hat Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Red Hat

5.4 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 16:24 vuln.today

CVSS changed

Jun 08, 2026 - 16:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in Google Chrome prior to version 149.0.7827.53 enables a remote, unauthenticated attacker to circumvent browser navigation policies by delivering a crafted HTML page to a victim. The flaw resides in the 'Actor' component of the Chromium engine, where policy enforcement is insufficient, leading to a high-integrity-impact breach (CVSS I:H) without any compromise of confidentiality or availability. No public exploit code and no active exploitation have been identified at time of analysis; EPSS stands at 0.02% (4th percentile), reinforcing a currently low real-world exploitation probability.

Technical ContextAI

The vulnerability is rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), meaning that the browser's internal 'Actor' subsystem - a Blink/renderer-layer component responsible for mediating navigation policy decisions - fails to adequately enforce restrictions that should be authoritatively applied. This class of flaw arises when a client-side component acts as the gatekeeper for a policy that can be subverted through crafted inputs, bypassing controls such as cross-origin navigation guards, frame sandboxing rules, or opener/opener-policy enforcement. The affected product is Google Chrome across all platforms running versions prior to 149.0.7827.53, as identified by the EUVD entry EUVD-2026-34467 and the Chromium stable channel advisory.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later; this is the vendor-released patch confirmed by the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this for most users, but enterprise-managed deployments should verify policy-enforced update channels are not blocking the rollout. If immediate patching is not feasible, organizations can reduce exposure by restricting untrusted browsing on affected endpoints, deploying browser isolation solutions that proxy rendering away from the endpoint, or applying content security policies at the network perimeter to block delivery of crafted HTML from untrusted origins - noting that network-layer controls will not prevent exploitation from trusted or whitelisted domains.